Security Key considerations for protecting remote workers
Many security and IT teams suddenly have to support and protect employees who must work remotely due to the COVID-19 crisis. Make sure you cover these areas.
1. Determine what endpoint protection you will require for home users
While you may have consoles and the ability to manage all the workstations at your physical office, you do not have the same level of control for home computers. Windows Defender included in Windows 10 is a more than acceptable antivirus tool for a remote machine.
Any remote worker that has a Macintosh should not be exempt from using endpoint protection software
2. Review what software remote employees need
For Office 365 subscribers, some of the licenses allow you to install the Office suite on up to five PCs or Macs, five tablets and five smartphones. Those with Volume licenses can allow Office for home use purchases for your employees. You may need to review your options and licensing alternatives based on what platform and version of Office you are currently licensed for.
You may want to add the ability to manage and monitor the remote systems of your users if they are not already under your control. Review what options you have with your current antivirus vendors to see if they have cloud consoles that can be easily used to manage these remote machines. Alternatively, if you have Office 365, you can use Intune with the proper licensing. Finally, reach out to consultants that you use; they may be able to provide temporary licenses with screen connection software that they already use to remotely manage your network.
3. Ensure remote access does not introduce more risk
You may have to suddenly set up and license remote access servers, Windows 10 virtual desktops or other remote technologies. Don’t introduce more risk in terms of licensing and security risks based on the decisions you make. For remote access that includes remote access services, remember that ransomware attackers look and scan for open RDP servers, targeting anything responding on port 3389. Don’t move RDP to another port as TSgrinder scans for an RDP response on any port.
Do not blindly open remote access ports without thinking of the risks and consequences accordingly. If you must open remote access, ensure that the firewall is configured to only respond to certain static IP addresses from which your IT administrators will be remotely accessing.
4. Implement two-factor authentication (2FA)
When adding more remote access solutions, consider adding 2FA to remote access solutions. You can easily add 2FA solutions such as DUO.com to existing on-premises remote access solutions. DUO.com can add 2FA to RDGateway and Remote Web Access solutions. While your firm may need to move quickly to allow your staff to work remotely, you can still ensure that only those admins and users are allowed in and not any attackers as well.
5. Use a virtual private network (VPN)
Recently there have been several high-profile vulnerabilities in VPN software. Often on client workstations that have not been updated in years, an older version of VPN software has been left behind. Ensure that your VPN solutions are up to date both on the server or firewall that is providing the VPN solutions, or on the desktops of the remote user.
6. Assess the impact to firewalls, conditional access policies and other logging
Your firm might have a security information and event management (SIEM) logging solution that looks at traffic coming from local desktops and laptops to server resources. If your entire workforce traffic suddenly comes in from various IP addresses, your logging platform data will no longer be “normal”.
Those who use geoblocking in the firewall to restrict access from different locations will need to review and revise those policies given that your firm’s employees will be coming in from various locations. You may also need to increase internet bandwidth for inbound traffic to your organization. For those who rely on cloud services, you may need to diagnose and determine if home users have appropriate bandwidth to support Office work and possibly video conferencing.
You also may find that the security settings of consumer firewalls and internet providers block some of your intended remote access. For example, Comcast’s advanced internet security blocks the use of RDgateway over port 443. You may need to review connection logs, get security logs from your remote users, and add more resources to your help desk to help users connect remotely.
7. Educate employees on COVID-19 scams
The National Cyber Awareness system warned of COVID-19 scams that are circulating. Urge your users to not click on unsolicited emails and to use only official websites. Ensure that the firm has a central online bulletin board that they go to for official communication and notification, especially if anyone in your organization becomes infected.
8. Update acceptable use policies for employees
Finally, ensure your acceptable computer use policies cover employees’ home computer assets. If this wording is not already there, you’ll need to quickly get up to speed in allowing employee’s personal assets be used for remote access. You’ll need to work with the firm’s attorneys and tax advisors to see if the use of personal computers and personal phones of the employees mandate a need for reimbursement for use.
Planning for the future
While this is a stressful time given the uncertainties, it’s also a great time for seeing how ready your organization is for emergencies and other remote worker needs. Even if you don’t tell everyone to work from home, take the time to think about if you could make everyone work from how and how well you could do it